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Requirements of 37 C.F.R. §41 .37 

I. 37 C.F.R. § 41 .37(c)(1)(i) - Real Party in Interest 

The real party in interest is Computer Associates Thinl<, Incorporated. 

II. 37 C.F.R. § 41 .37(c)(1)(ii) - Related Appeals and Interferences 

There are no related appeals and/or interferences. 

III. 37 C.F.R. S 41. 37(c)f1)(iii) - STATUS OF CLAIMS 

Pending : Claims 1-14, 16 and 17 are pending. 
Cancelled : Claims 1 5 and 1 8 have previously been cancelled. 
Rejected : Claims 1-14, 16 and 17 stand rejected. 
Allowed : No claims have been allowed. 

On Appeal : The rejections of claims 1-14, 16 and 17 are appealed. 

IV. 37 C.F.R. S 41.37(c)(1)(iv) - STATUS OF Amendments 

The claims have not been amended subsequent to the final rejection mailed 
October 25, 2006. 

V. 37 C.F.R. S 41 ■37(c)(1)(v) - Summary of Claimed Subject Matter 

Generally, network management systems monitor the operation and 
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implementation of liardware and/or software elements within a communication 
network to ensure that the performance of the network (and/or the elements therein) 
is maintained. Typically, network management systems are configured to generate 
alarms in response to "events" in which the performance and/or load of one or more 
elements in the network fall outside of predefined limits (as such events may impact 
the overall performance of the network). However, in conventional systems, alarms 
may be too sensitive such that events are over reported, or alarms may not be 
sensitive enough such that events are underreported. Drawbacks associated with the 
underreporting and/or over reporting of alarms and/or events by network 
management systems are known (see, e.g., the specification, pgs. 1 and 2). The 
claimed invention relates to a method and/or computer program that implements an 
advantageous technique for detecting an event on a network element, and 
generating alarm in response to the detected event. 

A. CLAIM 1 

One aspect of the invention relates to a method of monitoring an element in a 
computer network. In some embodiments, the method comprises monitoring a 
preselected variable relating to said element (e.g., the specification, pg. 10, lines 10- 
18); defining a threshold for the monitored preselected variable (e.g., the 
specification, pg. 13, lines 26-28, and pg. 20 line 16-pg. 21 line 8); establishing a 
sliding window in time (e.g., the specification, pg. 14 line 24-pg. 15 line 27); 
repeatedly generating a time above threshold value, said time above threshold value 
being a measure of an amount of time during which the monitored variable exceeded 
the threshold during the sliding window of time (e.g., the specification, pg. 14 line 24- 
pg. 15 line 27), wherein the measure of the amount of time during which the 
monitored variable exceeded the threshold during the sliding window in time includes 
an aggregation of two or more noncontiguous time intervals during which the 
monitored variable exceeded the threshold during the sliding window in time (e.g.. 
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the specification, pg. 14 line 24-pg. 15 line 27, and FIG. 5); detecting wlien the time 
above threshold value exceeds a predefined_condition window value {e.g., the 
specification, pg. 14 line 24-pg. 15 line 27); and in response to detecting when the 
time above threshold value exceeds said condition window, generating an alarm 
(e.g., the specification, pg. 14 line 24-pg. 15 line 27). 

B. CLAIM 13 

Another aspect of the invention relates to a method of monitoring an element 
in a computer networl<;. In some embodiments, the method comprises defining a 
profile for that element, said profile Including a plurality of different alarm rules, each 
of said different alarm rules establishing an alarm test for a corresponding one or 
more variables (e.g., the specification, pg. 11 line 20-pg. 13 line 5); detecting when 
the alarm test for any one or more of the plurality of different alarm rules is met (e.g., 
the specification, pg. 14 line 24-pg. 15 line 27); repeatedly generating a time above 
threshold value, said time above threshold value being a measure of an amount of 
time during which at least one of the one or more alarm tests has been met during a 
preselected prior window of time (e.g., the specification, pg. 14 line 24-pg. 15 line 
27), wherein the measure of the amount of time during which at least one of the one 
or more alarm tests has been met during the preselected prior window of time 
includes an aggregation of two or more noncontiguous time intervals during which at 
least one of the one or more alarm tests has been met during a preselected prior 
window of time (e.g., the specification, pg. 14 line 24-pg. 15 line 27, and FIG. 5); 
detecting when the time above threshold value exceeds a predefined condition 
window value (e.g., the specification, pg. 14 line 24-pg. 15 line 27); and in response 
to detecting when the time above threshold value exceeds said condition window, 
generating an alarm (e.g., the specification, pg. 14 line 24-pg. 15 line 27). 
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C. CLAIM 16 

Another aspect of the invention relates to a computer program stored on a 
computer-readable medium. In some embodiment, the computer program causes a 
computer system to perform the functions of monitoring a preselected variable 
relating to an element of a computer network (e.g., the specification, pg. 10, lines 10- 
18); defining a threshold for the monitored preselected variable (e.g., the 
specification, pg. 13, lines 26-28, and pg. 20 line 16-pg. 21 line 8); establishing a 
sliding window in time (e.g., the specification, pg. 14 line 24-pg. 15 line 27); 
repeatedly generating a time above threshold value, said time above threshold value 
being a measure of an amount of time during which the monitored variable exceeded 
the threshold during the sliding window of time (e.g., the specification, pg. 14 line 24- 
pg. 15 line 27), wherein the measure of the amount of time during which the 
monitored variable exceeded the threshold during the sliding window in time includes 
an aggregation of two or more noncontiguous time intervals during which the 
monitored variable exceeded the threshold during the sliding window in time (e.g., 
the specification, pg. 14 line 24-pg. 15 line 27, and FIG. 5); detecting when the time 
above threshold value exceeds a predefined condition window value (e.g., the 
specification, pg. 14 line 24-pg. 15 line 27); and in response to detecting when the 
time above threshold value exceeds said condition window; generating an alarm 
(e.g., the specification, pg. 14 line 24-pg. 15 line 27). 

D. CLAIM 17 

Another aspect of the invention relates to a computer program stored on a 
computer-readable medium. In some embodiment, the computer program causes a 
computer system to perform the functions of defining a profile for that element, said 
profile including a plurality of different alarm rules, each of said different alarm rules 
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establishing an alarm test for a corresponding one or more variables (e.g., the 
specification, pg. 1 1 line 20-pg. 13 line 5); detecting when the alarm test for any one 
or more of the plurality of different alarm rules is met (e.g., the specification, pg. 14 
line 24-pg. 15 line 27); repeatedly generating a time above threshold value, said time 
above threshold value being a measure of an amount of time during which at least 
one of the one or more alarm tests has been met during a preselected prior window 
of time (e.g., the specification, pg. 14 line 24-pg. 15 line 27), wherein the measure of 
the amount of time during which at least one of the one or more alarm tests has 
been met during the preselected prior window of time includes an aggregation of two 
or more noncontiguous time inten/als during which at least one of the one or more 
alarm tests has been met during a preselected prior window of time (e.g., the 
specification, pg. 14 line 24-pg. 15 line 27, and FIG. 5); detecting when the time 
above threshold value exceeds a predefined condition window value (e.g., the 
specification, pg. 14 line 24-pg. 15 line 27); and in response to detecting when the 
time above threshold value exceeds said condition window, generating an alarm 
(e.g., the specification, pg. 14 line 24-pg. 15 line 27). 

VI. 37 C.F.R. § 41.37(c)(1)(vn - GROUNDS OF REJECTION TO BE REVIEWED ON 

Appeal. 

Claims 1 , 13, 16, and 17 stand rejected under 35 U.S.C. § 102(b) as allegedly 
being anticipated by U.S. Patent No. 6,182,022 to Mayle et al. ("Mayle"). Claims 2-4 
and 14 stand rejected under 35 U.S.C. § 103(a) as allegedly being unpatentable over 
Mayle in view of U.S. Patent No. 6,098,195 to Northcott ("Northcott"). Claims 5-12 
stand rejected under 35 U.S.C. § 103(a) as allegedly being unpatentable over Mayle 
in view of U.S. Patent No. 6,397,359 to Chandra et al. ("Chandra"). 

VII. 37 C.F.R. § 41 .37(c)(1)(vli) - ARGUMENT 

The rejection of claims 1-14, 16, and 17 constitutes legal error at least 
because the sections of the cited references that are relied on by the Examiner fail to 
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disclose, teach, or suggest all of the features of the claimed invention. For instance, 
the Examiner has rejected each of independent claims 1, 13, 16, and 17 as allegedly 
being anticipated by Mayle. However, Mayle does not disclose all of the features of 
these claims. Accordingly, the rejection of these claims should be reversed. 

Claims 1 and 16 recite "wherein the measure of the amount of time during 
which the monitored variable exceeded the threshold during the sliding 
window In time Includes an aggregation of two or more noncontiguous time 
intervals during which the monitored variable exceeded the threshold during 
the sliding window In time." Similarly claims 13 and 17 recite "wherein the 
measure of the amount of time during which at least one of the one or more 
alarm tests has been met during the preselected prior window of time includes 
an aggregation of two or more noncontiguous time intervals during which at 
least one of the one or more alarm tests has been met during a preselected 
prior window of time." Mayle does not disclose at least these features of the 
claimed invention. 

The Examiner relies on Mayle at column 4 line 36-column 5 line 26, column 7 
lines 13-24, and column 8, lines 56-65 as allegedly disclosing features in Mayle that 
are analogous to the claim features reproduced above. See the Office Action, pg. 3. 
The cited passages of Mayle discuss monitoring one or more network metrics over a 
sliding time window, and disclose two separate techniques for triggering alarms 
based on the monitored metric(s). These two separate techniques are refered to at 
column 4, lines 22-25 as the "duration rule 68" and the "frequency rule 69" (shown in 
FIG. 2). The Examiner's reliance on these techniques constitutes legal error because 
neither the duration rule 68 nor the frequency rule 69 disclosed in the cited sections 
of Mayle are analogous to the claimed feature of measuring an "amount of time 
during which the monitored variable exceeded the threshold during the sliding 
window in time [that] includes an aggregation of two or more noncontiguous 
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time intervals during which the monitored variable exceeded the threshold 
during the sliding window in time." 

The duration rule 68 for triggering alarms disclosed in the cited sections of 
Mayie is illustrated in FIG. 3 and is discussed in Mayie at colunnn 4 line 64-column 65 
line 4. FIG. 3 and colunnn 4 line 64-colunnn 65 line 4 of Mayie are reproduced below 
for convenience. 

As an illustration, collected metrics curve 310 begins exceeding 
current normal threshold 304 at the collection of metric sample 314. 
Duration rule 68 requires the collected metrics curve 310 to continue to 
exceed current normal threshold 304 for a period of time T2 before 
generating an event. Accordingly, at time corresponding to the 
collection of metric sample 316 an alarm 62 is generated by event 
processor 60 of FIG. 1 . 



As should be appreciated from the reproduced sections of Mayle above, the 
duration rule 68 constitutes monitoring a single, contiguous period of time during 
which the monitored metric exceeds a threshold and, if the contiguous period of time 
exceeds a predetermined amount of time, triggering an alarm. The time that the 
metric exceeds the threshold (e.g., T2 in FIG. 3) is reset if the metric drops below the 
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threshold. Thus, the duration rule 68 does not anticipate the claimed features 
reproduced above, which include measuring an "amount of time ... [that] includes 
an aggregation of two or more noncontiguous time intervals. " 

FIG. 3 also shows a period of time in which the metric monitored in Mayle 
vacillates back and forth across the threshold (e.g., during T3). Column 5, lines 5-12 
of Mayle teaches that the frequency rule 69 should be used to generate an alarm 
during this period. Specifically, column 5, lines 5-12 of Mayle read as follows: 

Frequency rule 69 requires the number of collected metrics 310 
to exceed current normal threshold 304 a p re-determined number of 
times N over a pre-determined period of time T3 before generating an 
event. For example, suppose frequency rule 69 requires the collected 
metrics 310 to exceed current metric threshold 304 seven or more 
times over sliding time period T3 before generating an alarm. 

From this passage of Mayle, it should be appreciated that the frequency rule 
69 includes counting a number of times that the monitored metric breaches the 
threshold, and generating an alarm when the number of times during reaches a 
predetermined number. This is disclosed as being useful for generating alarms in 
instances in which the duration rule 68 does not generate an alarm because the 
duration rule 68 time period is reset each time the metric falls back below the 
threshold. See Mayle, col. 5, lines 17-26. Merely counting a number of times that the 
monitored metric breaches the threshold does not take into account the total amount 
of time spent above the threshold during noncontiguous periods. Thus, the frequency 
rule 69 described in the cited sections of Mayle does not properly anticipate the 
claimed features reproduced above, which include measuring an "amount of time ... 
[that] includes an aggregation of two or more noncontiguous time intervals." 

As has been demonstrated above, neither of the techniques described in the 
cited sections of Mayle for generating alarms based on a monitored metric (e.g., the 
duration rule 68 and the frequency rule 69) are disclosed as measuring an "amount 
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of time during wliich the monitored variable exceeded the threshold during the 
sliding window in time [that] includes an aggregation of two or more 
noncontiguous time intervals during which the monitored variable exceeded 
the threshold during the sliding window in time." Therefore, the cited sections of 
Mayle do not anticipate these features of the clainned invention. For at least tliis 
reason the rejection of claims 1, 13, 16, and 17 based on the cited portions of Mayle 
constitutes legal error and should be reversed. 

Claims 2-12 depend from claim 1 and claim 14 depends from claim 13. 
Claims 2-12 and 14 stand rejected based on Mayle in combination with either 
Northcott or Chandra. However, the cited sections of Northcott and Chandra do not 
address the deficiencies of Mayle discussed above. Therefore, the rejections of 
claims 2-12 and 14 based on Mayle in combination with Northcott or Chandra 
constitute legal error and should be reversed at least based on the dependency of 
claims 2-12 and 14, as well as for the features that they recite individually. 

VIII. 37 C.F.R. §41.37fc)(1)(viii) - Claims Appendix 

Appendix A: The pending claims (claims 1-14, 16, and 17) are attached in 
Appendix A. 

IX. 37 C.F.R. §41.37fcK1)(ix) - Evidence Appendix 
Appendix B: (None) 

X. 37 C.F.R. §41.37(C)(1)(X) - RELATED PROCEEDINGS INDEX 

Appendix C: (None) 
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For at least the foregoing reasons, Appellant respectfully requests that the 
rejection of each of pending claims 1-14, 16, and 17 be reversed. 

Date: AiA<ji^^^ IS, ZoOT Respectfully submitted. 

By: T>Bay^5Q~-l 

D. Benjan^jfrtsplin 
Registration No. 58,297 

Customer No. 00909 Pillsbury Winthrop Shaw PIttman LLP 

P.O. Box 10500 
McLean, Virginia 22102 
Main: 619-234-5000 
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Appendix A 

CLAIMS 

1 . (Previously Presented) A method of monitoring an element in a 
computer network, said method comprising: 

monitoring a preselected variable relating to said element; 
defining a threshold for the monitored preselected variable; 
establishing a sliding window in time; 

repeatedly generating a time above threshold value, said time above threshold 
value being a measure of an amount of time during which the monitored variable 
exceeded the threshold during the sliding window of time, wherein the measure of the 
amount of time during which the monitored variable exceeded the threshold during the 
sliding window in time includes an aggregation of two or more noncontiguous time 
intervals during which the monitored variable exceeded the threshold during the sliding 
window in time; 

detecting when the time above threshold value exceeds a predefined_condition 
window value; and 

in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm. 

2. (Original) The method of claim 1 further comprising after generating an alarm, 
maintaining the alarm at least as long as the time above threshold value exceeds a 
clear window value. 

3. (Original) The method of claim 2 wherein said clear window value is equal to 
said condition window value. 
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4. (Original) The method of claim 3 further comprising: 

monitoring a plurality of variables relating to said element, said preselected 
variable being one of said plurality of variables; and 

for each of the plurality of monitored variables, defining a corresponding 
threshold for that other variable, wherein the time above threshold value is a measure 
of an amount of time during which any one or more of the monitored variables 
exceeded its corresponding threshold during the corresponding sliding window of time. 

5. (Original) The method of claim 1 wherein the step of defining the threshold for 
the preselected variable comprises: 

computing an average value for the preselected variable based on values obtained for 
the preselected variable over a corresponding. prior period; 
defining an excursion amount; and 

setting the threshold equal to a sum of the average value plus the excursion 
amount. 

6. (Original) The method of claim 5 wherein the corresponding period of time is 
less than a day. 

7. (Original) The method of claim 6 wherein the corresponding period of time is a 
particular hour period of a day. 

8. (Original) The method of claim 6 wherein the step of computing the average 
comprises computing a mean value for the preselected variable using values obtained 
for that preselected variable for the same hour period of the same day of the week for a 
predetermined number of previous weel<s. 

9. (Original) The method of claim 5 wherein the step of defining an excursion 
amount comprises: 
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computing a standard deviation for ihe preselected variable based on values 
obtained for the preselected variable over a predetermined period of time; and 

setting the excursion amount equal to K times the computed standard deviation, 
wherein K is a positive number. 

1 0. (Original) The method of claim 9 wherein the step of computing the standard 
deviation comprises computing the standard deviation using values obtained for that 
preselected variable for the same hour period of the same day of the week for a 
predetermined number of previous weeks. 

1 1 . (Original) The method of claim 2 wherein the step of defining the threshold for 
the preselected variable comprises: 

defining an excursion amount; and 

setting the threshold equal to H less the excursion amount, where H is a positive 
number. 

12. (Original) The method of claim 1 1 wherein the step of defining an excursion 
amount comprises: 

computing a standard deviation for the preselected variable based on values 
obtained for the preselected variable over a predetermined period of time; and 

setting the excursion amount equal to K times the computed standard deviation, 
wherein K is a positive number. 

13. (Previously Presented) A method of monitoring an element in a computer 
network, said method comprising: 

defining a profile for that element, said profile including a plurality of different 
alarm rules, each of said different alarm rules establishing an alarm test for a 
corresponding one or more variables; 

detecting when the alarm test for any one or more of the plurality of different 
alarm rules is met; 
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repeatedly generating a time above threshold value, said time above threshold 
value being a measure of an amount of time during which at least one of the one or 
more alarm tests has been met during a preselected prior window of time, wherein the 
measure of the amount of time during which at least one of the one or more alarm tests 
has been met during the preselected prior window of time includes an aggregation of 
two or more noncontiguous time intervals during which at least one of the one or more 
alarm tests has been met during a preselected prior window of time; 

detecting when the time above threshold value exceeds a predefined condition 
window value; and 

in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm. 

1 4. (Original) The method of claim 1 3 further comprising after generating an 
exception, maintaining that exception at least as long as the time above threshold value 
exceeds a clear window value. 

15. (Cancel) 

16. (Previously Presented) A computer program stored on a computer-readable 
medium for causing a computer system to perform the functions of: 

monitoring a preselected variable relating to an element of a computer network; 
defining a threshold for the monitored preselected variable; 
establishing a sliding window in time; 

repeatedly generating a time above threshold value, said time above threshold 
value being a measure of an amount of time during which the monitored variable 
exceeded the threshold during the sliding window of time, wherein the measure of the 
amount of time during which the monitored variable exceeded the threshold during the 
sliding window in time includes an aggregation of two or more noncontiguous time 
intervals during which the monitored variable exceeded the threshold during the sliding 
window in time; 
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detecting when the tinne above threshold value exceeds a predefined condition 
window value; and 

in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm. 

17. (Previously Presented) A computer program for monitoring an element in a 
computer network, said program stored on a computer-readable medium for causing a 
computer system to perform the functions of: 

defining a profile for that element, said profile Including a plurality of different 
alarm rules, each of said different alarm rules establishing an alarm test for a 
corresponding one or more variables; 

detecting when the alarm test for any one or more of the plurality of different 
alarm rules is met; 

repeatedly generating a time above threshold value, said time above threshold 
value being a measure of an amount of time during which any one or more of the alarm 
tests has been met during a preselected prior window of time, wherein the measure of 
the amount of time during which any one or more of the alarm tests has been met 
during the preselected prior window of time includes an aggregation of two or more 
noncontiguous time intervals during which any one or more of the alarm tests has been 
met during the preselected prior window of time; 

detecting when the time above threshold value exceeds a predefined condition 
window value; and 

in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm. 

18. (Cancel) 
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Appendix b 
Evidence Appendix 



NONE 
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Appendix c 



Related Proceedings Index 



NONE 
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